CVE-2026-71863

Name of the Vulnerable Software and Affected Versions SecureDrop versions 2.13.0 through 2.16.0

Description When running the securedrop-admin install Ansible playbook with journalist alerts disabled, the journalist alert key filename remains empty. This causes the copy task to transfer all files located in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker who has compromised the privileged Monitor Server can obtain these credentials. However, these credentials serve as an additional protection layer and do not provide full access, as the Journalist Interface still requires a username, passphrase, and MFA, and SSH access still requires SSH keys.

Recommendations Update to version 2.16.1.